Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-5116 (GCVE-0-2016-5116)
Vulnerability from cvelistv5
- n/a
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T00:53:47.352Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "openSUSE-SU-2016:2363", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/libgd/libgd/issues/211" }, { "name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "name": "DSA-3619", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2016/dsa-3619" }, { "name": "USN-3030-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2016-05-29T00:00:00", "descriptions": [ { "lang": "en", "value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2016-11-25T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "openSUSE-SU-2016:2363", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/libgd/libgd/issues/211" }, { "name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "name": "DSA-3619", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2016/dsa-3619" }, { "name": "USN-3030-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-5116", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "openSUSE-SU-2016:2363", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "name": "https://github.com/libgd/libgd/issues/211", "refsource": "CONFIRM", "url": "https://github.com/libgd/libgd/issues/211" }, { "name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "name": "DSA-3619", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3619" }, { "name": "USN-3030-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "name": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4", "refsource": "CONFIRM", "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-5116", "datePublished": "2016-08-07T10:00:00", "dateReserved": "2016-05-29T00:00:00", "dateUpdated": "2024-08-06T00:53:47.352Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2016-5116\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-08-07T10:59:12.257\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.\"},{\"lang\":\"es\",\"value\":\"gd_xbm.c en la GD Graphics Library (tambi\u00e9n conocido como libgd) en versiones anteriores a 2.2.0, como se utiliza en ciertas configuraciones personalizadas PHP 5.5.x, permite a atacantes dependientes del contexto obtener informaci\u00f3n sensible del proceso de memoria o provocar una denegaci\u00f3n de servicio (lectura debajo de desbordamiento de b\u00fafer basado en la pila y ca\u00edda de aplicaci\u00f3n) a trav\u00e9s de un nombre largo.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:P\",\"baseScore\":6.4,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":true,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.2.1\",\"matchCriteriaId\":\"73B08A9F-CFCC-4B42-8F53-FC8C8AA44501\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F6D9B19-E64D-4BED-9194-17460CE19E6F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D25E591-448C-4E3B-8557-6E48F7571796\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DA18F3F-B4B5-40C3-BF19-67C1F0C1787D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AF783C9-26E7-4E02-BD41-77B9783667E3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF49701D-ECE4-4CEB-BDAB-24C09C8AD4B4\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AEDF6F7-001D-4A35-A26F-417991AD377F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4031DB99-B4B4-41EC-B3C1-543D92C575A9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5450EA7-A398-49D2-AA8E-7C95B074BAB1\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"04FE0E4E-BC94-4DC9-BE9B-DC57B952B2FB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"BB8E09D8-9CBE-4279-88B7-24A214A5A537\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D41ECCE-887D-49A2-9BB3-B559495AC55B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"79B418BC-27F4-4443-A0F7-FF4ADA568C1B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"8EEBDF62-BA1B-4438-9AEA-8B56AA5713E8\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F644EA6C-50C6-4A1C-A4AC-287AA9477B46\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DD47F30-74F5-48E8-8657-C2373FE2BD22\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C09527B-6B47-41F8-BDE6-01C47E452286\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E454D87-23CB-4D7F-90FE-942EE54D661F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1031E646-F2CF-4A3E-8E6A-5D4BC950BEDA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"130E50C1-D209-4CFF-9399-69D561340FBB\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1F29948-9417-460B-8B04-D91AE4E8B423\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A37D00C1-4F41-4400-9CE4-8E8BAA3E4142\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"093D08B7-CC3C-4616-8697-F15B253A7D9A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E9CD8FEE-DE7B-47CB-9985-4092BFA071D0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A30B2D9E-F289-43C9-BFBC-1CEF284A417E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE41CFDF-8ECD-41C1-94A7-5AFD42C5DDEA\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AEAC9BA-AF82-4345-839C-D339DCB962A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EFE682F-52E3-48EC-A993-F522FC29712F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC63A449-5D92-4F5F-8186-B58FFFBA54FE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F18236F6-2065-4A6A-93E7-FD90E650C689\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEFBA84A-A4E4-438B-B9B5-8549809DCECC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"146D3DC9-50F4-430B-B321-68ECE78879A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D5A7CA6-7653-46C5-8DF7-95584BF7A879\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5BA8300-2F4D-4C1E-8CCE-F45E8F3547A0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59A42F02-F363-4C13-BE83-19F757B84455\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"423ECD5F-5611-4D9A-8BE8-E4DC1527AF58\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44FE4648-22C5-44A6-A6DF-8B235EB7DEF5\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23006CC4-85FB-48AF-8F3A-97BC3FD7FAF6\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6393D02-3968-4B0F-A2DE-61442E95DB32\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F0E1ABF-05E0-4FB9-841E-6287B9D7E4D3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CDB4ADD-2148-47CD-93B2-1DD65067659A\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FE4651D-40F4-44BF-88AD-D0BFB85399D3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AE68A1B-B1EE-40BD-A294-69FE44746420\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4F004EF-2D0C-4ED3-A2D7-5BCB6B32C718\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65F170BE-283F-4C66-A123-562F8C93C097\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD1E1C27-7D14-414D-B067-48DD48B671A7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4FF1053-A485-47F3-B60E-F5A68AE46A5D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4863BE36-D16A-4D75-90D9-FD76DB5B48B7\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3619\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/05/29/5\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3030-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/libgd/libgd/issues/211\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3619\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/05/29/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-3030-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/libgd/libgd/issues/211\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Third Party Advisory\"]}]}}" } }
cnvd-2016-03817
Vulnerability from cnvd
Title: libgd内存泄露漏洞
Description:
libgd(又名GD Graphics Library或libgd2)是美国软件开发者Thomas Boutell所研发的一个开源的用于动态创建图像的库,它支持创建图表、图形和缩略图等。
libgd的‘gdCtxPrintf’函数中存在内存泄露漏洞,该漏洞源于程序未检查‘vsnprintf’函数的返回值,PHP 5.5版本将输出指定的长度值。攻击者可利用该漏洞造成内存数据泄露。
Severity: 中
Patch Name: libgd内存泄露漏洞的补丁
Patch Description:
libgd(又名GD Graphics Library或libgd2)是美国软件开发者Thomas Boutell所研发的一个开源的用于动态创建图像的库,它支持创建图表、图形和缩略图等。
libgd的‘gdCtxPrintf’函数中存在内存泄露漏洞,该漏洞源于程序未检查‘vsnprintf’函数的返回值,PHP 5.5版本将输出指定的长度值。攻击者可利用该漏洞造成内存数据泄露。目前,供应商发布了安全公告及相关补丁信息,修复了此漏洞。
Formal description:
目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接: https://github.com/libgd/libgd/issues/211
Reference: http://www.openwall.com/lists/oss-security/2016/05/29/5
Name | Libgd Libgd |
---|
{ "cves": { "cve": { "cveNumber": "CVE-2016-5116" } }, "description": "libgd\uff08\u53c8\u540dGD Graphics Library\u6216libgd2\uff09\u662f\u7f8e\u56fd\u8f6f\u4ef6\u5f00\u53d1\u8005Thomas Boutell\u6240\u7814\u53d1\u7684\u4e00\u4e2a\u5f00\u6e90\u7684\u7528\u4e8e\u52a8\u6001\u521b\u5efa\u56fe\u50cf\u7684\u5e93\uff0c\u5b83\u652f\u6301\u521b\u5efa\u56fe\u8868\u3001\u56fe\u5f62\u548c\u7f29\u7565\u56fe\u7b49\u3002\r\n\r\nlibgd\u7684\u2018gdCtxPrintf\u2019\u51fd\u6570\u4e2d\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u68c0\u67e5\u2018vsnprintf\u2019\u51fd\u6570\u7684\u8fd4\u56de\u503c\uff0cPHP 5.5\u7248\u672c\u5c06\u8f93\u51fa\u6307\u5b9a\u7684\u957f\u5ea6\u503c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u5185\u5b58\u6570\u636e\u6cc4\u9732\u3002", "discovererName": "unknown", "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/libgd/libgd/issues/211", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2016-03817", "openTime": "2016-06-07", "patchDescription": "libgd\uff08\u53c8\u540dGD Graphics Library\u6216libgd2\uff09\u662f\u7f8e\u56fd\u8f6f\u4ef6\u5f00\u53d1\u8005Thomas Boutell\u6240\u7814\u53d1\u7684\u4e00\u4e2a\u5f00\u6e90\u7684\u7528\u4e8e\u52a8\u6001\u521b\u5efa\u56fe\u50cf\u7684\u5e93\uff0c\u5b83\u652f\u6301\u521b\u5efa\u56fe\u8868\u3001\u56fe\u5f62\u548c\u7f29\u7565\u56fe\u7b49\u3002\r\n\r\nlibgd\u7684\u2018gdCtxPrintf\u2019\u51fd\u6570\u4e2d\u5b58\u5728\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u68c0\u67e5\u2018vsnprintf\u2019\u51fd\u6570\u7684\u8fd4\u56de\u503c\uff0cPHP 5.5\u7248\u672c\u5c06\u8f93\u51fa\u6307\u5b9a\u7684\u957f\u5ea6\u503c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u5185\u5b58\u6570\u636e\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "libgd\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01", "products": { "product": "Libgd Libgd" }, "referenceLink": "http://www.openwall.com/lists/oss-security/2016/05/29/5", "serverity": "\u4e2d", "submitTime": "2016-06-03", "title": "libgd\u5185\u5b58\u6cc4\u9732\u6f0f\u6d1e" }
ghsa-mvgw-h4r7-8g56
Vulnerability from github
gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.
{ "affected": [], "aliases": [ "CVE-2016-5116" ], "database_specific": { "cwe_ids": [ "CWE-119" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2016-08-07T10:59:00Z", "severity": "CRITICAL" }, "details": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.", "id": "GHSA-mvgw-h4r7-8g56", "modified": "2022-05-14T02:12:14Z", "published": "2022-05-14T02:12:14Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5116" }, { "type": "WEB", "url": "https://github.com/libgd/libgd/issues/211" }, { "type": "WEB", "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "type": "WEB", "url": "http://www.debian.org/security/2016/dsa-3619" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "type": "WEB", "url": "http://www.ubuntu.com/usn/USN-3030-1" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "type": "CVSS_V3" } ] }
suse-su-2016:2303-1
Vulnerability from csaf_suse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for gd", "title": "Title of the patch" }, { "category": "description", "text": "\nThis update for gd fixes the following issues:\n\n * CVE-2016-6214: Buffer over-read issue when parsing crafted TGA file [bsc#991436]\n * CVE-2016-6132: read out-of-bands was found in the parsing of TGA files using libgd [bsc#987577]\n * CVE-2016-6128: Invalid color index not properly handled [bsc#991710]\n * CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991622]\n * CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]\n * CVE-2016-5116: avoid stack overflow (read) with large names [bsc#982176]\n * CVE-2016-6905: Out-of-bounds read in function read_image_tga in gd_tga.c [bsc#995034]\n\n", "title": "Description of the patch" }, { "category": "details", "text": "SUSE-SLE-DESKTOP-12-SP1-2016-1347,SUSE-SLE-SDK-12-SP1-2016-1347,SUSE-SLE-SERVER-12-SP1-2016-1347,SUSE-SLE-WE-12-SP1-2016-1347", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_2303-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2016:2303-1", "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20162303-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2016:2303-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2016-September/002271.html" }, { "category": "self", "summary": "SUSE Bug 982176", "url": "https://bugzilla.suse.com/982176" }, { "category": "self", "summary": "SUSE Bug 987577", "url": "https://bugzilla.suse.com/987577" }, { "category": "self", "summary": "SUSE Bug 988032", "url": "https://bugzilla.suse.com/988032" }, { "category": "self", "summary": "SUSE Bug 991436", "url": "https://bugzilla.suse.com/991436" }, { "category": "self", "summary": "SUSE Bug 991622", "url": "https://bugzilla.suse.com/991622" }, { "category": "self", "summary": "SUSE Bug 991710", "url": "https://bugzilla.suse.com/991710" }, { "category": "self", "summary": "SUSE Bug 995034", "url": "https://bugzilla.suse.com/995034" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5116 page", "url": "https://www.suse.com/security/cve/CVE-2016-5116/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6128 page", "url": "https://www.suse.com/security/cve/CVE-2016-6128/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6132 page", "url": "https://www.suse.com/security/cve/CVE-2016-6132/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6161 page", "url": "https://www.suse.com/security/cve/CVE-2016-6161/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6207 page", "url": "https://www.suse.com/security/cve/CVE-2016-6207/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6214 page", "url": "https://www.suse.com/security/cve/CVE-2016-6214/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6905 page", "url": "https://www.suse.com/security/cve/CVE-2016-6905/" } ], "title": "Security update for gd", "tracking": { "current_release_date": "2016-09-14T07:12:19Z", "generator": { "date": "2016-09-14T07:12:19Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2016:2303-1", "initial_release_date": "2016-09-14T07:12:19Z", "revision_history": [ { "date": "2016-09-14T07:12:19Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "gd-devel-2.1.0-12.1.ppc64le", "product": { "name": "gd-devel-2.1.0-12.1.ppc64le", "product_id": "gd-devel-2.1.0-12.1.ppc64le" } }, { "category": "product_version", "name": "gd-2.1.0-12.1.ppc64le", "product": { "name": "gd-2.1.0-12.1.ppc64le", "product_id": "gd-2.1.0-12.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "gd-devel-2.1.0-12.1.s390x", "product": { "name": "gd-devel-2.1.0-12.1.s390x", "product_id": "gd-devel-2.1.0-12.1.s390x" } }, { "category": "product_version", "name": "gd-2.1.0-12.1.s390x", "product": { "name": "gd-2.1.0-12.1.s390x", "product_id": "gd-2.1.0-12.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "gd-2.1.0-12.1.x86_64", "product": { "name": "gd-2.1.0-12.1.x86_64", "product_id": "gd-2.1.0-12.1.x86_64" } }, { "category": "product_version", "name": "gd-32bit-2.1.0-12.1.x86_64", "product": { "name": "gd-32bit-2.1.0-12.1.x86_64", "product_id": "gd-32bit-2.1.0-12.1.x86_64" } }, { "category": "product_version", "name": "gd-devel-2.1.0-12.1.x86_64", "product": { "name": "gd-devel-2.1.0-12.1.x86_64", "product_id": "gd-devel-2.1.0-12.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux Enterprise Desktop 12 SP1", "product": { "name": "SUSE Linux Enterprise Desktop 12 SP1", "product_id": "SUSE Linux Enterprise Desktop 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sled:12:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Software Development Kit 12 SP1", "product": { "name": "SUSE Linux Enterprise Software Development Kit 12 SP1", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-sdk:12:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server 12 SP1", "product": { "name": "SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sles:12:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product": { "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sles_sap:12:sp1" } } }, { "category": "product_name", "name": "SUSE Linux Enterprise Workstation Extension 12 SP1", "product": { "name": "SUSE Linux Enterprise Workstation Extension 12 SP1", "product_id": "SUSE Linux Enterprise Workstation Extension 12 SP1", "product_identification_helper": { "cpe": "cpe:/o:suse:sle-we:12:sp1" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gd-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1", "product_id": "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64" }, "product_reference": "gd-2.1.0-12.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-32bit-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1", "product_id": "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64" }, "product_reference": "gd-32bit-2.1.0-12.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-devel-2.1.0-12.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP1", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le" }, "product_reference": "gd-devel-2.1.0-12.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-devel-2.1.0-12.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP1", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x" }, "product_reference": "gd-devel-2.1.0-12.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-devel-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP1", "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64" }, "product_reference": "gd-devel-2.1.0-12.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.1.0-12.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le" }, "product_reference": "gd-2.1.0-12.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.1.0-12.1.s390x as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x" }, "product_reference": "gd-2.1.0-12.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1", "product_id": "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64" }, "product_reference": "gd-2.1.0-12.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.1.0-12.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le" }, "product_reference": "gd-2.1.0-12.1.ppc64le", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.1.0-12.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x" }, "product_reference": "gd-2.1.0-12.1.s390x", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1", "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64" }, "product_reference": "gd-2.1.0-12.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1" }, { "category": "default_component_of", "full_product_name": { "name": "gd-32bit-2.1.0-12.1.x86_64 as component of SUSE Linux Enterprise Workstation Extension 12 SP1", "product_id": "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" }, "product_reference": "gd-32bit-2.1.0-12.1.x86_64", "relates_to_product_reference": "SUSE Linux Enterprise Workstation Extension 12 SP1" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-5116", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-5116" } ], "notes": [ { "category": "general", "text": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-5116", "url": "https://www.suse.com/security/cve/CVE-2016-5116" }, { "category": "external", "summary": "SUSE Bug 982176 for CVE-2016-5116", "url": "https://bugzilla.suse.com/982176" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2016-09-14T07:12:19Z", "details": "moderate" } ], "title": "CVE-2016-5116" }, { "cve": "CVE-2016-6128", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6128" } ], "notes": [ { "category": "general", "text": "The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6128", "url": "https://www.suse.com/security/cve/CVE-2016-6128" }, { "category": "external", "summary": "SUSE Bug 987580 for CVE-2016-6128", "url": "https://bugzilla.suse.com/987580" }, { "category": "external", "summary": "SUSE Bug 991710 for CVE-2016-6128", "url": "https://bugzilla.suse.com/991710" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2016-09-14T07:12:19Z", "details": "moderate" } ], "title": "CVE-2016-6128" }, { "cve": "CVE-2016-6132", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6132" } ], "notes": [ { "category": "general", "text": "The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6132", "url": "https://www.suse.com/security/cve/CVE-2016-6132" }, { "category": "external", "summary": "SUSE Bug 987577 for CVE-2016-6132", "url": "https://bugzilla.suse.com/987577" }, { "category": "external", "summary": "SUSE Bug 991436 for CVE-2016-6132", "url": "https://bugzilla.suse.com/991436" }, { "category": "external", "summary": "SUSE Bug 995034 for CVE-2016-6132", "url": "https://bugzilla.suse.com/995034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2016-09-14T07:12:19Z", "details": "moderate" } ], "title": "CVE-2016-6132" }, { "cve": "CVE-2016-6161", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6161" } ], "notes": [ { "category": "general", "text": "The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6161", "url": "https://www.suse.com/security/cve/CVE-2016-6161" }, { "category": "external", "summary": "SUSE Bug 988032 for CVE-2016-6161", "url": "https://bugzilla.suse.com/988032" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2016-09-14T07:12:19Z", "details": "low" } ], "title": "CVE-2016-6161" }, { "cve": "CVE-2016-6207", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6207" } ], "notes": [ { "category": "general", "text": "Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6207", "url": "https://www.suse.com/security/cve/CVE-2016-6207" }, { "category": "external", "summary": "SUSE Bug 991434 for CVE-2016-6207", "url": "https://bugzilla.suse.com/991434" }, { "category": "external", "summary": "SUSE Bug 991622 for CVE-2016-6207", "url": "https://bugzilla.suse.com/991622" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2016-09-14T07:12:19Z", "details": "moderate" } ], "title": "CVE-2016-6207" }, { "cve": "CVE-2016-6214", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6214" } ], "notes": [ { "category": "general", "text": "gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6214", "url": "https://www.suse.com/security/cve/CVE-2016-6214" }, { "category": "external", "summary": "SUSE Bug 987577 for CVE-2016-6214", "url": "https://bugzilla.suse.com/987577" }, { "category": "external", "summary": "SUSE Bug 991436 for CVE-2016-6214", "url": "https://bugzilla.suse.com/991436" }, { "category": "external", "summary": "SUSE Bug 995034 for CVE-2016-6214", "url": "https://bugzilla.suse.com/995034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2016-09-14T07:12:19Z", "details": "moderate" } ], "title": "CVE-2016-6214" }, { "cve": "CVE-2016-6905", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6905" } ], "notes": [ { "category": "general", "text": "The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6905", "url": "https://www.suse.com/security/cve/CVE-2016-6905" }, { "category": "external", "summary": "SUSE Bug 995034 for CVE-2016-6905", "url": "https://bugzilla.suse.com/995034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "SUSE Linux Enterprise Desktop 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Desktop 12 SP1:gd-32bit-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.s390x", "SUSE Linux Enterprise Server for SAP Applications 12 SP1:gd-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.ppc64le", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.s390x", "SUSE Linux Enterprise Software Development Kit 12 SP1:gd-devel-2.1.0-12.1.x86_64", "SUSE Linux Enterprise Workstation Extension 12 SP1:gd-32bit-2.1.0-12.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2016-09-14T07:12:19Z", "details": "moderate" } ], "title": "CVE-2016-6905" } ] }
opensuse-su-2024:10062-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "gd-2.2.3-2.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the gd-2.2.3-2.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-10062", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10062-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2014-2497 page", "url": "https://www.suse.com/security/cve/CVE-2014-2497/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5116 page", "url": "https://www.suse.com/security/cve/CVE-2016-5116/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5766 page", "url": "https://www.suse.com/security/cve/CVE-2016-5766/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6128 page", "url": "https://www.suse.com/security/cve/CVE-2016-6128/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6132 page", "url": "https://www.suse.com/security/cve/CVE-2016-6132/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6207 page", "url": "https://www.suse.com/security/cve/CVE-2016-6207/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6214 page", "url": "https://www.suse.com/security/cve/CVE-2016-6214/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-6905 page", "url": "https://www.suse.com/security/cve/CVE-2016-6905/" } ], "title": "gd-2.2.3-2.1 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:10062-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "gd-2.2.3-2.1.aarch64", "product": { "name": "gd-2.2.3-2.1.aarch64", "product_id": "gd-2.2.3-2.1.aarch64" } }, { "category": "product_version", "name": "gd-devel-2.2.3-2.1.aarch64", "product": { "name": "gd-devel-2.2.3-2.1.aarch64", "product_id": "gd-devel-2.2.3-2.1.aarch64" } }, { "category": "product_version", "name": "libgd3-2.2.3-2.1.aarch64", "product": { "name": "libgd3-2.2.3-2.1.aarch64", "product_id": "libgd3-2.2.3-2.1.aarch64" } }, { "category": "product_version", "name": "libgd3-32bit-2.2.3-2.1.aarch64", "product": { "name": "libgd3-32bit-2.2.3-2.1.aarch64", "product_id": "libgd3-32bit-2.2.3-2.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "gd-2.2.3-2.1.ppc64le", "product": { "name": "gd-2.2.3-2.1.ppc64le", "product_id": "gd-2.2.3-2.1.ppc64le" } }, { "category": "product_version", "name": "gd-devel-2.2.3-2.1.ppc64le", "product": { "name": "gd-devel-2.2.3-2.1.ppc64le", "product_id": "gd-devel-2.2.3-2.1.ppc64le" } }, { "category": "product_version", "name": "libgd3-2.2.3-2.1.ppc64le", "product": { "name": "libgd3-2.2.3-2.1.ppc64le", "product_id": "libgd3-2.2.3-2.1.ppc64le" } }, { "category": "product_version", "name": "libgd3-32bit-2.2.3-2.1.ppc64le", "product": { "name": "libgd3-32bit-2.2.3-2.1.ppc64le", "product_id": "libgd3-32bit-2.2.3-2.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "gd-2.2.3-2.1.s390x", "product": { "name": "gd-2.2.3-2.1.s390x", "product_id": "gd-2.2.3-2.1.s390x" } }, { "category": "product_version", "name": "gd-devel-2.2.3-2.1.s390x", "product": { "name": "gd-devel-2.2.3-2.1.s390x", "product_id": "gd-devel-2.2.3-2.1.s390x" } }, { "category": "product_version", "name": "libgd3-2.2.3-2.1.s390x", "product": { "name": "libgd3-2.2.3-2.1.s390x", "product_id": "libgd3-2.2.3-2.1.s390x" } }, { "category": "product_version", "name": "libgd3-32bit-2.2.3-2.1.s390x", "product": { "name": "libgd3-32bit-2.2.3-2.1.s390x", "product_id": "libgd3-32bit-2.2.3-2.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "gd-2.2.3-2.1.x86_64", "product": { "name": "gd-2.2.3-2.1.x86_64", "product_id": "gd-2.2.3-2.1.x86_64" } }, { "category": "product_version", "name": "gd-devel-2.2.3-2.1.x86_64", "product": { "name": "gd-devel-2.2.3-2.1.x86_64", "product_id": "gd-devel-2.2.3-2.1.x86_64" } }, { "category": "product_version", "name": "libgd3-2.2.3-2.1.x86_64", "product": { "name": "libgd3-2.2.3-2.1.x86_64", "product_id": "libgd3-2.2.3-2.1.x86_64" } }, { "category": "product_version", "name": "libgd3-32bit-2.2.3-2.1.x86_64", "product": { "name": "libgd3-32bit-2.2.3-2.1.x86_64", "product_id": "libgd3-32bit-2.2.3-2.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gd-2.2.3-2.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64" }, "product_reference": "gd-2.2.3-2.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.2.3-2.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le" }, "product_reference": "gd-2.2.3-2.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.2.3-2.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x" }, "product_reference": "gd-2.2.3-2.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "gd-2.2.3-2.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64" }, "product_reference": "gd-2.2.3-2.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "gd-devel-2.2.3-2.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64" }, "product_reference": "gd-devel-2.2.3-2.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "gd-devel-2.2.3-2.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le" }, "product_reference": "gd-devel-2.2.3-2.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "gd-devel-2.2.3-2.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x" }, "product_reference": "gd-devel-2.2.3-2.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "gd-devel-2.2.3-2.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64" }, "product_reference": "gd-devel-2.2.3-2.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libgd3-2.2.3-2.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64" }, "product_reference": "libgd3-2.2.3-2.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libgd3-2.2.3-2.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le" }, "product_reference": "libgd3-2.2.3-2.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libgd3-2.2.3-2.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x" }, "product_reference": "libgd3-2.2.3-2.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libgd3-2.2.3-2.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64" }, "product_reference": "libgd3-2.2.3-2.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libgd3-32bit-2.2.3-2.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64" }, "product_reference": "libgd3-32bit-2.2.3-2.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libgd3-32bit-2.2.3-2.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le" }, "product_reference": "libgd3-32bit-2.2.3-2.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libgd3-32bit-2.2.3-2.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x" }, "product_reference": "libgd3-32bit-2.2.3-2.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "libgd3-32bit-2.2.3-2.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" }, "product_reference": "libgd3-32bit-2.2.3-2.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2014-2497", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-2497" } ], "notes": [ { "category": "general", "text": "The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-2497", "url": "https://www.suse.com/security/cve/CVE-2014-2497" }, { "category": "external", "summary": "SUSE Bug 868624 for CVE-2014-2497", "url": "https://bugzilla.suse.com/868624" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2014-2497" }, { "cve": "CVE-2016-5116", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-5116" } ], "notes": [ { "category": "general", "text": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-5116", "url": "https://www.suse.com/security/cve/CVE-2016-5116" }, { "category": "external", "summary": "SUSE Bug 982176 for CVE-2016-5116", "url": "https://bugzilla.suse.com/982176" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2016-5116" }, { "cve": "CVE-2016-5766", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-5766" } ], "notes": [ { "category": "general", "text": "Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-5766", "url": "https://www.suse.com/security/cve/CVE-2016-5766" }, { "category": "external", "summary": "SUSE Bug 986386 for CVE-2016-5766", "url": "https://bugzilla.suse.com/986386" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2016-5766" }, { "cve": "CVE-2016-6128", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6128" } ], "notes": [ { "category": "general", "text": "The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6128", "url": "https://www.suse.com/security/cve/CVE-2016-6128" }, { "category": "external", "summary": "SUSE Bug 987580 for CVE-2016-6128", "url": "https://bugzilla.suse.com/987580" }, { "category": "external", "summary": "SUSE Bug 991710 for CVE-2016-6128", "url": "https://bugzilla.suse.com/991710" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2016-6128" }, { "cve": "CVE-2016-6132", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6132" } ], "notes": [ { "category": "general", "text": "The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6132", "url": "https://www.suse.com/security/cve/CVE-2016-6132" }, { "category": "external", "summary": "SUSE Bug 987577 for CVE-2016-6132", "url": "https://bugzilla.suse.com/987577" }, { "category": "external", "summary": "SUSE Bug 991436 for CVE-2016-6132", "url": "https://bugzilla.suse.com/991436" }, { "category": "external", "summary": "SUSE Bug 995034 for CVE-2016-6132", "url": "https://bugzilla.suse.com/995034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2016-6132" }, { "cve": "CVE-2016-6207", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6207" } ], "notes": [ { "category": "general", "text": "Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6207", "url": "https://www.suse.com/security/cve/CVE-2016-6207" }, { "category": "external", "summary": "SUSE Bug 991434 for CVE-2016-6207", "url": "https://bugzilla.suse.com/991434" }, { "category": "external", "summary": "SUSE Bug 991622 for CVE-2016-6207", "url": "https://bugzilla.suse.com/991622" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2016-6207" }, { "cve": "CVE-2016-6214", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6214" } ], "notes": [ { "category": "general", "text": "gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6214", "url": "https://www.suse.com/security/cve/CVE-2016-6214" }, { "category": "external", "summary": "SUSE Bug 987577 for CVE-2016-6214", "url": "https://bugzilla.suse.com/987577" }, { "category": "external", "summary": "SUSE Bug 991436 for CVE-2016-6214", "url": "https://bugzilla.suse.com/991436" }, { "category": "external", "summary": "SUSE Bug 995034 for CVE-2016-6214", "url": "https://bugzilla.suse.com/995034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2016-6214" }, { "cve": "CVE-2016-6905", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2016-6905" } ], "notes": [ { "category": "general", "text": "The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2016-6905", "url": "https://www.suse.com/security/cve/CVE-2016-6905" }, { "category": "external", "summary": "SUSE Bug 995034 for CVE-2016-6905", "url": "https://bugzilla.suse.com/995034" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "openSUSE Tumbleweed:gd-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.s390x", "openSUSE Tumbleweed:gd-devel-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-2.2.3-2.1.x86_64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.aarch64", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.ppc64le", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.s390x", "openSUSE Tumbleweed:libgd3-32bit-2.2.3-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2016-6905" } ] }
fkie_cve-2016-5116
Vulnerability from fkie_nvd
Vendor | Product | Version | |
---|---|---|---|
libgd | libgd | * | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.0 | |
php | php | 5.5.1 | |
php | php | 5.5.2 | |
php | php | 5.5.3 | |
php | php | 5.5.4 | |
php | php | 5.5.5 | |
php | php | 5.5.6 | |
php | php | 5.5.7 | |
php | php | 5.5.8 | |
php | php | 5.5.9 | |
php | php | 5.5.10 | |
php | php | 5.5.11 | |
php | php | 5.5.12 | |
php | php | 5.5.13 | |
php | php | 5.5.14 | |
php | php | 5.5.18 | |
php | php | 5.5.19 | |
php | php | 5.5.20 | |
php | php | 5.5.21 | |
php | php | 5.5.22 | |
php | php | 5.5.23 | |
php | php | 5.5.24 | |
php | php | 5.5.25 | |
php | php | 5.5.26 | |
php | php | 5.5.27 | |
php | php | 5.5.28 | |
php | php | 5.5.29 | |
php | php | 5.5.30 | |
php | php | 5.5.31 | |
php | php | 5.5.32 | |
php | php | 5.5.33 | |
php | php | 5.5.34 | |
php | php | 5.5.35 | |
php | php | 5.5.37 | |
opensuse | leap | 42.1 | |
debian | debian_linux | 8.0 |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:*", "matchCriteriaId": "73B08A9F-CFCC-4B42-8F53-FC8C8AA44501", "versionEndIncluding": "2.2.1", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "9F6D9B19-E64D-4BED-9194-17460CE19E6F", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "3D25E591-448C-4E3B-8557-6E48F7571796", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "6DA18F3F-B4B5-40C3-BF19-67C1F0C1787D", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "3AF783C9-26E7-4E02-BD41-77B9783667E3", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "EF49701D-ECE4-4CEB-BDAB-24C09C8AD4B4", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "7AEDF6F7-001D-4A35-A26F-417991AD377F", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "4031DB99-B4B4-41EC-B3C1-543D92C575A9", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "D5450EA7-A398-49D2-AA8E-7C95B074BAB1", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "04FE0E4E-BC94-4DC9-BE9B-DC57B952B2FB", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "BB8E09D8-9CBE-4279-88B7-24A214A5A537", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "2D41ECCE-887D-49A2-9BB3-B559495AC55B", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "79B418BC-27F4-4443-A0F7-FF4ADA568C1B", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "8EEBDF62-BA1B-4438-9AEA-8B56AA5713E8", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "F644EA6C-50C6-4A1C-A4AC-287AA9477B46", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "4DD47F30-74F5-48E8-8657-C2373FE2BD22", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*", "matchCriteriaId": "0C09527B-6B47-41F8-BDE6-01C47E452286", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*", "matchCriteriaId": "2E454D87-23CB-4D7F-90FE-942EE54D661F", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*", "matchCriteriaId": "1031E646-F2CF-4A3E-8E6A-5D4BC950BEDA", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*", "matchCriteriaId": "130E50C1-D209-4CFF-9399-69D561340FBB", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*", "matchCriteriaId": "C1F29948-9417-460B-8B04-D91AE4E8B423", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*", "matchCriteriaId": "A37D00C1-4F41-4400-9CE4-8E8BAA3E4142", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*", "matchCriteriaId": "093D08B7-CC3C-4616-8697-F15B253A7D9A", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*", "matchCriteriaId": "E9CD8FEE-DE7B-47CB-9985-4092BFA071D0", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*", "matchCriteriaId": "A30B2D9E-F289-43C9-BFBC-1CEF284A417E", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*", "matchCriteriaId": "FE41CFDF-8ECD-41C1-94A7-5AFD42C5DDEA", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*", "matchCriteriaId": "6AEAC9BA-AF82-4345-839C-D339DCB962A7", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*", "matchCriteriaId": "1EFE682F-52E3-48EC-A993-F522FC29712F", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*", "matchCriteriaId": "AC63A449-5D92-4F5F-8186-B58FFFBA54FE", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*", "matchCriteriaId": "F18236F6-2065-4A6A-93E7-FD90E650C689", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*", "matchCriteriaId": "DEFBA84A-A4E4-438B-B9B5-8549809DCECC", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*", "matchCriteriaId": "146D3DC9-50F4-430B-B321-68ECE78879A7", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*", "matchCriteriaId": "1D5A7CA6-7653-46C5-8DF7-95584BF7A879", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*", "matchCriteriaId": "C5BA8300-2F4D-4C1E-8CCE-F45E8F3547A0", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*", "matchCriteriaId": "59A42F02-F363-4C13-BE83-19F757B84455", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*", "matchCriteriaId": "423ECD5F-5611-4D9A-8BE8-E4DC1527AF58", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*", "matchCriteriaId": "44FE4648-22C5-44A6-A6DF-8B235EB7DEF5", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*", "matchCriteriaId": "23006CC4-85FB-48AF-8F3A-97BC3FD7FAF6", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*", "matchCriteriaId": "D6393D02-3968-4B0F-A2DE-61442E95DB32", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:*", "matchCriteriaId": "0F0E1ABF-05E0-4FB9-841E-6287B9D7E4D3", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:*", "matchCriteriaId": "0CDB4ADD-2148-47CD-93B2-1DD65067659A", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:*", "matchCriteriaId": "7FE4651D-40F4-44BF-88AD-D0BFB85399D3", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:*", "matchCriteriaId": "9AE68A1B-B1EE-40BD-A294-69FE44746420", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:*", "matchCriteriaId": "D4F004EF-2D0C-4ED3-A2D7-5BCB6B32C718", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:*", "matchCriteriaId": "65F170BE-283F-4C66-A123-562F8C93C097", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:*", "matchCriteriaId": "CD1E1C27-7D14-414D-B067-48DD48B671A7", "vulnerable": false }, { "criteria": "cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:*", "matchCriteriaId": "C4FF1053-A485-47F3-B60E-F5A68AE46A5D", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*", "matchCriteriaId": "4863BE36-D16A-4D75-90D9-FD76DB5B48B7", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name." }, { "lang": "es", "value": "gd_xbm.c en la GD Graphics Library (tambi\u00e9n conocido como libgd) en versiones anteriores a 2.2.0, como se utiliza en ciertas configuraciones personalizadas PHP 5.5.x, permite a atacantes dependientes del contexto obtener informaci\u00f3n sensible del proceso de memoria o provocar una denegaci\u00f3n de servicio (lectura debajo de desbordamiento de b\u00fafer basado en la pila y ca\u00edda de aplicaci\u00f3n) a trav\u00e9s de un nombre largo." } ], "id": "CVE-2016-5116", "lastModified": "2025-04-12T10:46:40.837", "metrics": { "cvssMetricV2": [ { "acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.0" }, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2016-08-07T10:59:12.257", "references": [ { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "http://www.debian.org/security/2016/dsa-3619" }, { "source": "cve@mitre.org", "tags": [ "Mailing List" ], "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "source": "cve@mitre.org", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ], "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" }, { "source": "cve@mitre.org", "tags": [ "Issue Tracking", "Third Party Advisory" ], "url": "https://github.com/libgd/libgd/issues/211" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "http://www.debian.org/security/2016/dsa-3619" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List" ], "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ], "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Third Party Advisory" ], "url": "https://github.com/libgd/libgd/issues/211" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-119" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
gsd-2016-5116
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2016-5116", "description": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.", "id": "GSD-2016-5116", "references": [ "https://www.suse.com/security/cve/CVE-2016-5116.html", "https://www.debian.org/security/2016/dsa-3619", "https://ubuntu.com/security/CVE-2016-5116", "https://advisories.mageia.org/CVE-2016-5116.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2016-5116" ], "details": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.", "id": "GSD-2016-5116", "modified": "2023-12-13T01:21:25.347079Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-5116", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "openSUSE-SU-2016:2363", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "name": "https://github.com/libgd/libgd/issues/211", "refsource": "CONFIRM", "url": "https://github.com/libgd/libgd/issues/211" }, { "name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "name": "DSA-3619", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3619" }, { "name": "USN-3030-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-3030-1" }, { "name": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4", "refsource": "CONFIRM", "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:libgd:libgd:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2.2.1", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.30:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.29:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.35:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.37:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.34:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-5116" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-119" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4", "refsource": "CONFIRM", "tags": [ "Issue Tracking", "Patch", "Third Party Advisory" ], "url": "https://github.com/libgd/libgd/commit/4dc1a2d7931017d3625f2d7cff70a17ce58b53b4" }, { "name": "[oss-security] 20160529 Re: CVE Request: libgd - gdCtxPrintf memory leak", "refsource": "MLIST", "tags": [ "Mailing List" ], "url": "http://www.openwall.com/lists/oss-security/2016/05/29/5" }, { "name": "https://github.com/libgd/libgd/issues/211", "refsource": "CONFIRM", "tags": [ "Issue Tracking", "Third Party Advisory" ], "url": "https://github.com/libgd/libgd/issues/211" }, { "name": "DSA-3619", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "http://www.debian.org/security/2016/dsa-3619" }, { "name": "openSUSE-SU-2016:2363", "refsource": "SUSE", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html" }, { "name": "USN-3030-1", "refsource": "UBUNTU", "tags": [], "url": "http://www.ubuntu.com/usn/USN-3030-1" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": true, "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.0" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } }, "lastModifiedDate": "2018-10-30T16:27Z", "publishedDate": "2016-08-07T10:59Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.